Anmelden
Deutsch English Español Polski
Hoch

Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages

  • Veröffentlicht: 14.10.2025
  • Aktualisiert: 11.10.2026 10:22

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/parameters are run on the host and circumvent the intended nodevm sandbox restrictions, resulting in execution of arbitrary code in the context of the host.

NOTE: This vulnerability was incorrectly assigned as a duplicate CVE-2025-26319 and should be considered distinct from that identifier.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
npm-Paket flowise >= 3.0.1, < 3.0.8 3.0.8

Verweise

CVSS-Wert -
CVSS-Vektor
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L
Schwäche (CWE)
CWE-77
Plattform
npm
Paket
flowise
Veröffentlicht
14.10.2025
Aktualisiert
11.10.2026 10:22

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-r4hh-pcgx-j5r2 - CC BY 4.0

Schwachstellenhistorie: flowise

Alle veröffentlichten Schwachstellen dieses Pakets (npm-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (114) im Archiv
Einträge insgesamt
114
Erste → letzte
04.2024 10.2026
Ohne Fix
16
In Angriffen ausgenutzt
0

Verteilung nach Schweregrad

  • Kritisch 28
  • Hoch 62
  • Mittel 24

Veröffentlichungen pro Jahr

Schweregrad:
  1. Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
    Kritisch CVE-2026-73487 < 3.1.3 3.1.3
  2. Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
    Kritisch CVE-2026-73483 < 3.1.3 3.1.3
  3. Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
    Kritisch CVE-2026-70478 < 3.1.3 3.1.3
  4. Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    Kritisch CVE-2026-70477 < 3.1.3 3.1.3
  5. Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
    Hoch CVE-2026-70476 < 3.1.3 3.1.3
  6. Flowise: Missing Authorization on Execution Update Endpoint
    Hoch CVE-2026-70475 < 3.1.3 3.1.3
  7. Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
    Hoch CVE-2026-70474 < 3.1.3 3.1.3
  8. Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
    Hoch CVE-2026-70473 < 3.1.3 3.1.3
  9. Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
    Hoch CVE-2026-70472 < 3.1.3 3.1.3
  10. Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
    Kritisch CVE-2026-69264 < 3.1.3 3.1.3
  11. Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
    Hoch ghsa-88pr-878c-24wf < 3.1.3 3.1.3
  12. Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
    Hoch CVE-2026-70471 < 3.1.3 3.1.3
  13. Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
    Kritisch CVE-2026-70470 < 3.1.3 3.1.3
  14. Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
    Hoch CVE-2026-69263 < 3.1.3 3.1.3
  15. Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type
    Hoch CVE-2026-69262 < 3.1.3 3.1.3
  16. Flowise RCE via SQLite Record Manager Node
    Kritisch CVE-2026-69259 < 3.1.3 3.1.3
  17. Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
    Hoch CVE-2026-69258 < 3.1.3 3.1.3
  18. Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
    Hoch CVE-2026-69257 < 3.1.3 3.1.3
  19. Flowise: Remote Code Execution Vulnerability in CSVAgent
    Kritisch CVE-2026-69256 < 3.1.3 3.1.3
  20. Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
    Kritisch CVE-2026-69255 < 3.1.3 3.1.3
  21. Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
    Kritisch CVE-2026-69254 < 3.1.3 3.1.3
  22. Flowise Sandbox Escape to RCE
    Kritisch CVE-2026-69253 < 3.1.3 3.1.3
  23. Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
    Hoch CVE-2026-69252 < 3.1.3 3.1.3
  24. Flowise RCE via TypeORM DataSource
    Kritisch CVE-2026-69251 < 3.1.3 3.1.3
  25. Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration
    Hoch CVE-2026-69250 < 3.1.3 3.1.3
  26. FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover
    Hoch · 8.8 CVE-2026-46480 < 3.1.2 3.1.2
  27. FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
    Hoch · 8.8 CVE-2026-46479 < 3.1.2 3.1.2
  28. FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover
    Hoch · 8.8 CVE-2026-46478 < 3.1.2 3.1.2
  29. FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover
    Hoch · 8.8 CVE-2026-46477 < 3.1.2 3.1.2
  30. FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
    Hoch CVE-2026-46476 < 3.1.2 3.1.2
  31. FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover
    Hoch · 8.8 CVE-2026-46475 < 3.1.2 3.1.2
  32. FlowiseAI: Vector Store No Permission Checks
    Hoch · 8.8 CVE-2026-46444 < 3.1.2 3.1.2
  33. FlowiseAI Vulnerable to Credential Data Leak
    Hoch CVE-2026-46443 < 3.1.2 3.1.2
  34. FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
    Kritisch CVE-2026-46442 < 3.1.2 3.1.2
  35. FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment
    Hoch CVE-2026-46441 < 3.1.2 3.1.2
  36. Flowise has an MCP Security Bypass that Enables RCE
    Hoch CVE-2026-56274 < 3.1.2 3.1.2
  37. FlowiseAI Exposes Basic Auth Credentials via API
    Hoch · 7.5 CVE-2026-46440 < 3.1.2 3.1.2
  38. FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment
    Hoch CVE-2026-42863 < 3.1.2 3.1.2
  39. FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment
    Hoch CVE-2026-42862 < 3.1.2 3.1.2
  40. FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment
    Hoch CVE-2026-42861 < 3.1.2 3.1.2
  41. Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    Kritisch · 9.8 CVE-2026-41264 < 3.1.0 3.1.0
  42. Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
    Kritisch · 9.8 CVE-2026-41265 < 3.1.0 3.1.0
  43. Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
    Hoch · 7.5 CVE-2026-41279 < 3.1.0 3.1.0
  44. Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
    Hoch · 7.5 CVE-2026-41278 < 3.1.0 3.1.0
  45. Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
    Hoch · 8.8 CVE-2026-41277 < 3.1.0 3.1.0
  46. Flowise: resetPassword Authentication Bypass Vulnerability
    Hoch · 9.8 CVE-2026-41276 < 3.1.0 3.1.0
  47. Flowise: Cypher Injection in GraphCypherQAChain
    Hoch CVE-2026-41274 < 3.1.0 3.1.0
  48. Flowise: Password Reset Link Sent Over Unsecured HTTP
    Hoch · 7.5 CVE-2026-41275 < 3.1.0 3.1.0
  49. Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise
    Hoch · 8.2 CVE-2026-41273 < 3.1.0 3.1.0
  50. Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
    Hoch · 7.1 CVE-2026-41271 < 3.1.0 3.1.0
  51. Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
    Hoch · 7.1 CVE-2026-41272 < 3.1.0 3.1.0
  52. Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
    Hoch · 7.1 CVE-2026-41270 < 3.1.0 3.1.0
  53. Flowise: File Upload Validation Bypass in createAttachment
    Hoch · 7.1 CVE-2026-41269 < 3.1.0 3.1.0
  54. Flowise: Parameter Override Bypass Remote Command Execution
    Hoch · 7.7 CVE-2026-41268 < 3.1.0 3.1.0
  55. Flowise: Sensitive Data Leak in public-chatbotConfig
    Hoch · 7.5 CVE-2026-41266 < 3.1.0 3.1.0
  56. Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
    Hoch · 8.1 CVE-2026-41267 < 3.1.0 3.1.0
  57. Flowise: Code Injection in CSVAgent leads to Authenticated RCE
    Kritisch · 8.8 CVE-2026-41137 < 3.1.0 3.1.0
  58. Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
    Hoch · 8.3 CVE-2026-41138 < 3.1.0 3.1.0
  59. Flowise: Authenticated RCE Via MCP Adapters
    Kritisch · 9.9 CVE-2026-40933 < 3.1.0 3.1.0
  60. Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
    Hoch · 7.1 CVE-2026-31829 < 3.0.13 3.0.13
  61. Flowise Missing Authentication on NVIDIA NIM Endpoints
    Hoch CVE-2026-30824 < 3.0.13 3.0.13
  62. Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
    Hoch · 8.8 CVE-2026-30823 < 3.0.13 3.0.13
  63. Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
    Hoch · 7.7 CVE-2026-30822 < 3.0.13 3.0.13
  64. Flowise has Arbitrary File Upload via MIME Spoofing
    Hoch CVE-2026-30821 < 3.0.13 3.0.13
  65. Flowise has Authorization Bypass via Spoofed x-request-from Header
    Hoch CVE-2026-30820 < 3.0.13 3.0.13
  66. Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)
    Hoch CVE-2025-71327 = 3.0.1 keine Korrektur
  67. Flowise Fails to Invalidate Existing Sessions After Password Changes
    Hoch · 8.1 CVE-2025-71335 < 3.0.10 3.0.10
  68. Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages dieser Eintrag
    Hoch CVE-2025-34267 >= 3.0.1, < 3.0.8 3.0.8
  69. Flowise is vulnerable to arbitrary file exposure through its ReadFileTool
    Hoch · 7.7 ghsa-j44m-5v8f-gc9c < 3.0.8 3.0.8
  70. Flowise is vulnerable to arbitrary file write through its WriteFileTool
    Kritisch · 9.9 CVE-2025-61913 < 3.0.8, < 3.0.8 3.0.8
  71. FlowiseAI/Flosise has File Upload vulnerability
    Hoch · 8.3 CVE-2025-61687 >= 3.0.7, < 3.0.8 3.0.8
  72. Flowise vulnerable to RCE via Dynamic function constructor injection
    Kritisch · 9.8 CVE-2025-55346 <= 2.2.7-patch.1 keine Korrektur
  73. Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
    Kritisch · 9.3 CVE-2025-50538 < 3.0.8 3.0.8
  74. Flowise has unsandboxed remote code execution via Custom MCP
    Hoch CVE-2025-71336 >= 2.2.7-patch.1, < 3.0.6 3.0.6
  75. Flowise has arbitrary file access due to missing chat flow id validation
    Kritisch · 9.8 CVE-2025-71334 >= 2.2.8, < 3.0.6 3.0.6
  76. Flowise has an Arbitrary File Read
    Kritisch · 9.1 CVE-2025-71324 >= 3.0.5, < 3.0.6 3.0.6
  77. Flowise has Remote Code Execution vulnerability
    Kritisch · 10.0 CVE-2025-59528 >= 3.0.5, < 3.0.6 3.0.6
  78. FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
    Hoch · 7.5 CVE-2025-59527 >= 3.0.5, < 3.0.6 3.0.6
  79. FlowiseAI Pre-Auth Arbitrary Code Execution
    Kritisch · 9.1 CVE-2025-57164 >= 3.0.5, < 3.0.6 3.0.6
  80. Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
    Kritisch · 9.8 CVE-2025-58434 < 3.0.6 3.0.6
Mehr anzeigen (10) 80 von 90 angezeigt

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.